561b3cf57b33e115cabbb36756579d7fb15ae90656b826cbd286673b2eaef227

Analysis

max time kernel
37s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
06/08/2021, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
400ef1a8d25089cfe029cf5082fe7c51.exe
Size 1.9MB
Sample210806-vnt47fpkca
SHA256 561b3cf57b33e115cabbb36756579d7fb15ae90656b826cbd286673b2eaef227
MD5 400ef1a8d25089cfe029cf5082fe7c51
SHA1 ea96f87330628b292b975afdb663c6f55d143f5f
SHA512 72e0dd37687653104e22505d6e886d7eafe6f4f1a34882786dd59e2917157646fdf0eb81c7186203da22a2c3346ef9917e39fa084cad24e81881af1e4ad76002
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
200	svchost32.exe
2900	services32.exe
2604	svchost32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\services32.exe	svchost32.exe
File opened for modification	C:\Windows\system32\services32.exe	svchost32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
592	schtasks.exe
3740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
684	powershell.exe
684	powershell.exe
684	powershell.exe
3872	powershell.exe
3872	powershell.exe
3872	powershell.exe
3448	powershell.exe
3448	powershell.exe
3448	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
200	svchost32.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
3312	powershell.exe
3312	powershell.exe
3312	powershell.exe
2652	powershell.exe
2652	powershell.exe
2652	powershell.exe
2692	powershell.exe
2692	powershell.exe
2692	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	684	powershell.exe
Token: SeIncreaseQuotaPrivilege	684	powershell.exe
Token: SeSecurityPrivilege	684	powershell.exe
Token: SeTakeOwnershipPrivilege	684	powershell.exe
Token: SeLoadDriverPrivilege	684	powershell.exe
Token: SeSystemProfilePrivilege	684	powershell.exe
Token: SeSystemtimePrivilege	684	powershell.exe
Token: SeProfSingleProcessPrivilege	684	powershell.exe
Token: SeIncBasePriorityPrivilege	684	powershell.exe
Token: SeCreatePagefilePrivilege	684	powershell.exe
Token: SeBackupPrivilege	684	powershell.exe
Token: SeRestorePrivilege	684	powershell.exe
Token: SeShutdownPrivilege	684	powershell.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeSystemEnvironmentPrivilege	684	powershell.exe
Token: SeRemoteShutdownPrivilege	684	powershell.exe
Token: SeUndockPrivilege	684	powershell.exe
Token: SeManageVolumePrivilege	684	powershell.exe
Token: 33	684	powershell.exe
Token: 34	684	powershell.exe
Token: 35	684	powershell.exe
Token: 36	684	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeIncreaseQuotaPrivilege	3872	powershell.exe
Token: SeSecurityPrivilege	3872	powershell.exe
Token: SeTakeOwnershipPrivilege	3872	powershell.exe
Token: SeLoadDriverPrivilege	3872	powershell.exe
Token: SeSystemProfilePrivilege	3872	powershell.exe
Token: SeSystemtimePrivilege	3872	powershell.exe
Token: SeProfSingleProcessPrivilege	3872	powershell.exe
Token: SeIncBasePriorityPrivilege	3872	powershell.exe
Token: SeCreatePagefilePrivilege	3872	powershell.exe
Token: SeBackupPrivilege	3872	powershell.exe
Token: SeRestorePrivilege	3872	powershell.exe
Token: SeShutdownPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeSystemEnvironmentPrivilege	3872	powershell.exe
Token: SeRemoteShutdownPrivilege	3872	powershell.exe
Token: SeUndockPrivilege	3872	powershell.exe
Token: SeManageVolumePrivilege	3872	powershell.exe
Token: 33	3872	powershell.exe
Token: 34	3872	powershell.exe
Token: 35	3872	powershell.exe
Token: 36	3872	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3120	2256	400ef1a8d25089cfe029cf5082fe7c51.exe	72
PID 2256 wrote to memory of 3120	2256	400ef1a8d25089cfe029cf5082fe7c51.exe	72
PID 3120 wrote to memory of 684	3120	cmd.exe	74
PID 3120 wrote to memory of 684	3120	cmd.exe	74
PID 3120 wrote to memory of 3872	3120	cmd.exe	79
PID 3120 wrote to memory of 3872	3120	cmd.exe	79
PID 3120 wrote to memory of 3448	3120	cmd.exe	80
PID 3120 wrote to memory of 3448	3120	cmd.exe	80
PID 3120 wrote to memory of 3948	3120	cmd.exe	81
PID 3120 wrote to memory of 3948	3120	cmd.exe	81
PID 2256 wrote to memory of 2532	2256	400ef1a8d25089cfe029cf5082fe7c51.exe	85
PID 2256 wrote to memory of 2532	2256	400ef1a8d25089cfe029cf5082fe7c51.exe	85
PID 2532 wrote to memory of 200	2532	cmd.exe	87
PID 2532 wrote to memory of 200	2532	cmd.exe	87
PID 200 wrote to memory of 2576	200	svchost32.exe	88
PID 200 wrote to memory of 2576	200	svchost32.exe	88
PID 2576 wrote to memory of 592	2576	cmd.exe	90
PID 2576 wrote to memory of 592	2576	cmd.exe	90
PID 200 wrote to memory of 2900	200	svchost32.exe	91
PID 200 wrote to memory of 2900	200	svchost32.exe	91
PID 200 wrote to memory of 1376	200	svchost32.exe	92
PID 200 wrote to memory of 1376	200	svchost32.exe	92
PID 2900 wrote to memory of 1804	2900	services32.exe	94
PID 2900 wrote to memory of 1804	2900	services32.exe	94
PID 1804 wrote to memory of 2664	1804	cmd.exe	96
PID 1804 wrote to memory of 2664	1804	cmd.exe	96
PID 1376 wrote to memory of 684	1376	cmd.exe	97
PID 1376 wrote to memory of 684	1376	cmd.exe	97
PID 1804 wrote to memory of 3312	1804	cmd.exe	98
PID 1804 wrote to memory of 3312	1804	cmd.exe	98
PID 1804 wrote to memory of 2652	1804	cmd.exe	99
PID 1804 wrote to memory of 2652	1804	cmd.exe	99
PID 1804 wrote to memory of 2692	1804	cmd.exe	100
PID 1804 wrote to memory of 2692	1804	cmd.exe	100
PID 2900 wrote to memory of 3056	2900	services32.exe	101
PID 2900 wrote to memory of 3056	2900	services32.exe	101
PID 3056 wrote to memory of 2604	3056	cmd.exe	103
PID 3056 wrote to memory of 2604	3056	cmd.exe	103
PID 2604 wrote to memory of 2576	2604	svchost32.exe	104
PID 2604 wrote to memory of 2576	2604	svchost32.exe	104
PID 2576 wrote to memory of 3740	2576	cmd.exe	106
PID 2576 wrote to memory of 3740	2576	cmd.exe	106
PID 2604 wrote to memory of 2540	2604	svchost32.exe	108
PID 2604 wrote to memory of 2540	2604	svchost32.exe	108
PID 2540 wrote to memory of 2516	2540	cmd.exe	110
PID 2540 wrote to memory of 2516	2540	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\400ef1a8d25089cfe029cf5082fe7c51.exe
"C:\Users\Admin\AppData\Local\Temp\400ef1a8d25089cfe029cf5082fe7c51.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\400ef1a8d25089cfe029cf5082fe7c51.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\svchost32.exe
    C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\400ef1a8d25089cfe029cf5082fe7c51.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:200
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:592
  - - C:\Windows\system32\services32.exe
      "C:\Windows\system32\services32.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2664
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3312
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2652
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2692
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\svchost32.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
        8⤵
        Creates scheduled task(s)
        
        PID:3740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        8⤵
        
        PID:2516
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/200-278-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Download

memory/200-280-0x0000000001A90000-0x0000000001A91000-memory.dmp

Download

memory/200-283-0x0000000003A80000-0x0000000003A82000-memory.dmp

Download

memory/684-168-0x00000246E66B8000-0x00000246E66B9000-memory.dmp

Download

memory/684-151-0x00000246E66B6000-0x00000246E66B8000-memory.dmp

Download

memory/684-128-0x00000246E6870000-0x00000246E6871000-memory.dmp

Download

memory/684-125-0x00000246E66C0000-0x00000246E66C1000-memory.dmp

Download

memory/684-123-0x00000246E66B0000-0x00000246E66B2000-memory.dmp

Download

memory/684-124-0x00000246E66B3000-0x00000246E66B5000-memory.dmp

Download

memory/2256-114-0x0000000000E70000-0x0000000000E71000-memory.dmp

Download

memory/2256-122-0x0000000001880000-0x0000000001882000-memory.dmp

Download

memory/2604-455-0x000000001C9A0000-0x000000001C9A2000-memory.dmp

Download

memory/2652-406-0x000002D621C23000-0x000002D621C25000-memory.dmp

Download

memory/2652-407-0x000002D621C26000-0x000002D621C28000-memory.dmp

Download

memory/2652-404-0x000002D621C20000-0x000002D621C22000-memory.dmp

Download

memory/2652-405-0x000002D621C28000-0x000002D621C29000-memory.dmp

Download

memory/2664-329-0x00000205A3A36000-0x00000205A3A38000-memory.dmp

Download

memory/2664-364-0x00000205A3A38000-0x00000205A3A39000-memory.dmp

Download

memory/2664-327-0x00000205A3A30000-0x00000205A3A32000-memory.dmp

Download

memory/2664-328-0x00000205A3A33000-0x00000205A3A35000-memory.dmp

Download

memory/2692-444-0x000001A32C683000-0x000001A32C685000-memory.dmp

Download

memory/2692-446-0x000001A32C688000-0x000001A32C689000-memory.dmp

Download

memory/2692-443-0x000001A32C680000-0x000001A32C682000-memory.dmp

Download

memory/2692-445-0x000001A32C686000-0x000001A32C688000-memory.dmp

Download

memory/2900-294-0x000000001CB50000-0x000000001CB52000-memory.dmp

Download

memory/3312-366-0x00000230CC4F3000-0x00000230CC4F5000-memory.dmp

Download

memory/3312-368-0x00000230CC4F8000-0x00000230CC4F9000-memory.dmp

Download

memory/3312-367-0x00000230CC4F6000-0x00000230CC4F8000-memory.dmp

Download

memory/3312-365-0x00000230CC4F0000-0x00000230CC4F2000-memory.dmp

Download

memory/3448-213-0x0000028826516000-0x0000028826518000-memory.dmp

Download

memory/3448-210-0x0000028826513000-0x0000028826515000-memory.dmp

Download

memory/3448-208-0x0000028826510000-0x0000028826512000-memory.dmp

Download

memory/3448-244-0x0000028826518000-0x0000028826519000-memory.dmp

Download

memory/3872-207-0x000002893E098000-0x000002893E099000-memory.dmp

Download

memory/3872-171-0x000002893E093000-0x000002893E095000-memory.dmp

Download

memory/3872-170-0x000002893E096000-0x000002893E098000-memory.dmp

Download

memory/3872-169-0x000002893E090000-0x000002893E092000-memory.dmp

Download

memory/3948-272-0x000002E6556D6000-0x000002E6556D8000-memory.dmp

Download

memory/3948-273-0x000002E6556D8000-0x000002E6556D9000-memory.dmp

Download

memory/3948-246-0x000002E6556D3000-0x000002E6556D5000-memory.dmp

Download

memory/3948-245-0x000002E6556D0000-0x000002E6556D2000-memory.dmp

Download